IA-12(1): Supervisor Authorization
Control Family:
Parent Control:
CSF v2.0 References:
Threats Addressed:
Baselines:
- OT High (SP 800-82r3)
Control is new to this version of the control set and incorporates the following item from the previous version: IA-4(2): Supervisor Authorization.
Control Statement
Require that the registration process to receive an account for logical access includes supervisor or sponsor authorization.
Supplemental Guidance
Including supervisor or sponsor authorization as part of the registration process provides an additional level of scrutiny to ensure that the user's management chain is aware of the account, the account is essential to carry out organizational missions and functions, and the user's privileges are appropriate for the anticipated responsibilities and authorities within the organization.
OT Discussion
Maintenance, engineering, or third-party organizations may require OT access in order to support operations. The organization should determine the AO for proving identity prior to allowing access to the OT environment. Consider obtaining supervisor or sponsor authorization, where the sponsor may be someone within operations.
OT Baseline Rationale
Rationale for adding to High baseline: A supervisor or sponsor should be made aware of any access that an employee has to the OT environment since unauthorized or accidental access could affect the physical process.